It puts additional burden upon the IT department to always send a valid certificate. Of course, it should never happen that we send an expired or revoked certificate. But mistakes happen. I'm skeptical.

Fascinating. When I curl -v http://wikiba.se/ontologyI get a < Location: https://www.wikiba.se/ontology and afterwards only < Location: http://www.wikiba.se/ontology-1.0.owl

I missed some .htacces redirects when migrating to nginx. Please try now if it works as intended.

@abian Ah, I didn't configure www.wikiba.se. Now I ran into Let's Encrypt rate limiting because I didn't know how to properly configure multiple nginx server names with puppet. I will try again in an hour, but then it should be complete.

https://wikiba.se now up and running. I think, it can be closed, then.

In T155359#5400653, @Dzahn wrote:

What GreenReaper said, you can use "webroot" authenticator with certbot so you don't need DNS for it, but if you want DNS then see above, that's also possible.

Currently, the authoritatitative nameservers for wikiba.se are the WMF nameservers. I don't know what your NetOps configured there, so no, I cannot setup Let's Encrypt. Of course, I could configure the default nameservers again, point A and AAAA to some of our servers and deploy Let's Encrypt there, but I believe that wasn't the intention behind your suggestion, @GreenReaper.

I am out of this. Currently, ns[0-2].wikimedia.org are authoritative for wikiba.se: T99531#4862262.

wikiba.se is now authoritatively nameserved by ns[012].wikimedia.org.

Did someone ask for a zone file? I have a zone file! Here, take a zone file! ;-)

Please use my WMDE tagged account, MasinAlDujailiWMDE.

@kai.nissen *drop comment*

It's still an issue. Here's an email: